Splunk Enterprise

Event timestamp extraction not working after creating sourcetype in splunk web gui

BKDRockz1
Observer

Hi Team,

I'm trying to add customized event timestamp by extracting from raw data instead of adding current time as the event time.

To achieve this I created a sourcetype with following settings from splunk web gui after testing in lower environment. But in production it is not functioning as expected.

BKDRockz1_0-1731922110745.png



Raw data: 
2024-11-18 09:20:10.187, STAGE_INV_TXNS_ID="xxxxxxxxx", LOC="xxxxxxx", STORE_NAME="xxxxxxx", STORE_PCODE="xxxxxxxxx", TRAN_CODE="xxxx", TRANS_TYPE="xxxxxxx", TRAN_DATE_TIME="2024-11-18 09:09:27", LAST_UPDATE_USER="xxxxxx"
2024-11-18 09:20:10.187, STAGE_INV_TXNS_ID="xxxxxxxxx", LOC="xxxxxxx", STORE_NAME="xxxxxxx", STORE_PCODE="xxxxxxxxx", TRAN_CODE="xxxx", TRANS_TYPE="xxxxxxx", TRAN_DATE_TIME="2024-11-18 09:09:27", LAST_UPDATE_USER="xxxxxx"
2024-11-18 09:20:10.187, STAGE_INV_TXNS_ID="xxxxxxxxx", LOC="xxxxxxx", STORE_NAME="xxxxxxx", STORE_PCODE="xxxxxxxxx", TRAN_CODE="xxxx", TRANS_TYPE="xxxxxxx", TRAN_DATE_TIME="2024-11-18 09:09:28", LAST_UPDATE_USER="xxxxxxx"
2024-11-18 09:20:10.187, STAGE_INV_TXNS_ID="xxxxxxxxx", LOC="xxxxxxx", STORE_NAME="xxxxxxx", STORE_PCODE="xxxxxxxxx", TRAN_CODE="xxxx", TRANS_TYPE="xxxxxxx", TRAN_DATE_TIME="2024-11-18 09:09:30", LAST_UPDATE_USER="xxxxx"


I want the timestamp in TRAN_DATE_TIME field to be event timestamp. This data we are pulling from database using db connect.

Could you please help us in understanding whats going wrong and how it can be corrected.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try extending your MAX_TIMESTAMP_LOOKAHEAD to include the part of the event containing the TRANS_DATE_TIME field (when counted from the beginning of the event data)?

0 Karma

BKDRockz1
Observer

@ITWhisperer  I tried MAX_TIMESTAMP_LOOKAHEAD value with 0 , -1 to disable the timestamp processor as per splunk docs on props.conf and also tried increasing the lookahead value to 350.

But nothing seems to be working. 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...